bad signature / checksum on ISO download

[jmart303]

I'm getting a bad signature and the wrong checksum on the ISO image
located here
Is there an updated version?
https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/main/DOWNLOAD_AND_VERIFY_ISO.md

[dougburks]

I just downloaded and everything looks fine from my vantage point:

wget https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso
--2024-06-12 06:46:46--  https://download.securityonion.net/file/securityonion/securityonion-2.4.70-20240529.iso
Resolving download.securityonion.net (download.securityonion.net)... 104.26.15.42, 104.26.14.42, 172.67.69.209, ...
Connecting to download.securityonion.net (download.securityonion.net)|104.26.15.42|:443... connected.
HTTP request sent, awaiting response... 200 
Length: unspecified [application/x-iso9660-image]
Saving to: ‘securityonion-2.4.70-20240529.iso’

securityonion-2.4.70-20240529.iso                                   [                                                                                                                     <=>                              ]  11.54G  7.35MB/s    in 29m 9s  

2024-06-12 07:15:56 (6.76 MB/s) - ‘securityonion-2.4.70-20240529.iso’ saved [12396265472]

gpg --verify securityonion-2.4.70-20240529.iso.sig securityonion-2.4.70-20240529.iso
gpg: Signature made Wed 29 May 2024 11:40:59 AM EDT
gpg:                using RSA key C804A93D36BE0C733EA196447C1060B7FE507013
gpg: Good signature from "Security Onion Solutions, LLC <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: C804 A93D 36BE 0C73 3EA1  9644 7C10 60B7 FE50 7013

md5sum securityonion-2.4.70-20240529.iso
8fccf31c2470d1aba380af196b611dec  securityonion-2.4.70-20240529.iso

sha1sum securityonion-2.4.70-20240529.iso
ee5e8f8c14819e7a1fe423e6920531a97f39600b  securityonion-2.4.70-20240529.iso

sha256sum securityonion-2.4.70-20240529.iso
ef5e781d50d50660f452adc54fd4911296ecbeced7879fa8e04687337ca89bec  securityonion-2.4.70-20240529.iso

From https://docs.securityonion.net/en/2.4/download.html:

If it fails to verify, try downloading again. If it still fails to verify, try downloading from another computer or another network.

[jmart303]

These are my results, and I have tried twice.
I'll try from another computer/network

$ gpg --verify securityonion-2.4.70-20240529.iso.sig securityonion-2.4.70-20240529.iso
gpg: Signature made Wed 29 May 2024 09:40:59 AM MDT
gpg: using RSA key C804A93D36BE0C733EA196447C1060B7FE507013
gpg: BAD signature from "Security Onion Solutions, LLC [email protected]" [unknown]

$ md5sum securityonion-2.4.70-20240529.iso
c463ed40c2a262275913794cf778bedb securityonion-2.4.70-20240529.iso

$ sha1sum securityonion-2.4.70-20240529.iso
05465eeb35fe0f63c5afb87a2e09584c77aa11be securityonion-2.4.70-20240529.iso

$ sha256sum securityonion-2.4.70-20240529.iso
c883716eee63a697a839da91419f91ae4eece252a026434e83c7c8dbf87355b1 securityonion-2.4.70-20240529.iso

[jmart303]

Downloading from my mac I was able to get a good signature